Incident · State breach notice (Massachusetts)
Minnesota ENT data breach: six email accounts, one mailbox that could not be ruled out
Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.
The Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT data breach affected 99,714 people, according to the federal health breach portal, where Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT reported a hacking or IT incident as a health care provider on August 12, 2026. Minnesota ENT, the trade name of Oakdale Ear Nose & Throat PA, says it detected unauthorized access to six of its staff email accounts on or about January 16, 2026. Its investigation could not rule out that one of those mailboxes had been read or copied, and a review of that mailbox found patients' personal and health information in emails and attachments. The federal health breach list counts 99,714 people, with email as the location of the data. Its own website notice lists the data: names, dates of birth, Social Security numbers, driver's license numbers, financial account information, medical information and health insurance information, varying by person. Letters went out from August 12, 2026 and offer Experian IdentityWorks.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
What happened at Minnesota ENT?
The practice says it secured its network, changed every email password and opened an investigation with outside cybersecurity professionals. The practice says it could not conclude with 100% certainty that the contents of one mailbox were not accessed or acquired.
| Date | What the letter and the regulators' records say |
|---|---|
| On or around January 16, 2026 | Unauthorized access to six email accounts detected |
| July 15, 2026 | Review finds personal and health information in the one mailbox |
| August 12, 2026 | Report to HHS (99,714); logged in Massachusetts (14 residents) |
The review of a single mailbox took six months.
Was my Social Security number in the Minnesota ENT breach?
The sample letter filed in Massachusetts leaves the list of data items blank, but the notice on Minnesota ENT's own website fills it in. The items vary by person and include first and last name, date of birth, Social Security number, driver's license number, financial account information, medical information and health insurance information.
| Data item | Website notice | Massachusetts record (14 residents) |
|---|---|---|
| Name | Yes | Not a category |
| Date of birth | Yes | Not a category |
| Social Security number | Yes | Yes |
| Driver's license number | Yes | No |
| Financial account information | Yes | No |
| Medical information | Yes | Yes (medical records) |
| Health insurance information | Yes | Not a category |
The website notice says the July 15, 2026 finding was that the impacted files may have contained personal information, and that notices began on August 12, 2026, as state and federal law require. For the 14 Massachusetts residents in Minnesota ENT's notice, the state's record marks Social Security numbers and medical records as breached. The practice says it has no evidence that anyone's information has been used for financial fraud or identity theft. It says it has strengthened its network and made security improvements that outside experts recommended.
What is Minnesota ENT offering?
| Item | Detail from the letter |
|---|---|
| Service | Experian IdentityWorks, for the number of months printed on each letter |
| Questions | (844) 958-8943, 9:00 a.m. to 6:30 p.m. Eastern Time, Monday to Friday, excluding holidays |
The guide to credit monitoring offers sets Minnesota ENT's offer beside other letters, and the guide to healthcare provider breach notices compares other practices' letters.
What the documents leave open
- How the intruder got into six accounts at once.
- Why only one of the six mailboxes is treated as possibly read.
With 99,714 people, Minnesota ENT's report is the 48th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.
How this disclosure's timing compares
Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT disclosed 208 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
Other health care incidents on cisonews.net
- MPOWERHealth Holdings LLC, Breach notice, first disclosed November 13, 2026
- Acadia Healthcare Company, Inc., Breach notice, first disclosed November 13, 2026
- Telecare Health, Breach notice, first disclosed November 9, 2026
- Sharecare Health Data Services, LLC, Breach notice, first disclosed November 6, 2026
- Nephrology Associates, P.C., Breach notice, first disclosed November 6, 2026
Sources
- 2026-08-12 · AOakdale Ear Nose & Throat PA d/b/a Minnesota ENT, notice of data breach filed with the Massachusetts Office of Consumer Affairs and Business Regulation, published August 12, 2026
- 2026-11-07 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (breaches affecting 500 or more individuals), published November 7, 2026
- 2026-11-07 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 7, 2026
- 2026-08-12 · AOakdale Ear Nose & Throat PA d/b/a Minnesota ENT, Notice of Data Security Incident (website notice), published August 12, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.